dimmus
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ecore_evas extn - fix buffer n check for lock files with untrusted val 

the code added by minkyoung has a definite security flaw here trusting
e->response to be within a small range when all it is is an int -
range is not limited other than that... so fix the code to check for
range like further code below does.

this commit went in 2 days ago... so not an existing bug fix.
This commit is contained in:
Carsten Haitzler 2017-03-23 16:27:19 +09:00
parent 2787f0fe5d
commit 02a7e00c01
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/modules/ecore_evas/engines/extn/ecore_evas_extn.c
View File

@ -1021,16 +1021,20 @@ _ipc_server_data(void *data, int type EINA_UNUSED, void *event)
{
Ipc_Data_Update *ipc;
int n = e->response;
/* b->lockfd is not enough to ensure the size is same
* between what server knows, and client knows.
* So should check file lock also. */
if (extn->b[n].buf && (!_extnbuf_lock_file_get(extn->b[n].buf)))
{
EINA_LIST_FREE(extn->file.updates, ipc)
if ((n >= 0) && (n < NBUF))
{
if (extn->b[n].buf && (!_extnbuf_lock_file_get(extn->b[n].buf)))
{
free(ipc);
EINA_LIST_FREE(extn->file.updates, ipc)
{
free(ipc);
}
break;
}
break;
}
EINA_LIST_FREE(extn->file.updates, ipc)